https://blog.ast.moe/en/tags/izanagi/Recent posts: GorimuchuHugohttps://blog.ast.moe/en/blog/2026-10-09/Fri, 09 Oct 2026 10:03:32 +0900https://blog.ast.moe/en/blog/2026-10-09/<p>In the previous article (<a href="https://blog.ast.moe/en/blog/2026-10-08-3/">source</a>), we introduced Izanagi, which isolates and runs development commands while recording file accesses and network communications. This time, we discuss the addition of behavior analysis using Jev.</p> <p>Existing detection rules issue warnings based on a single action—such as an attempt to open a secret file, a connection to an address outside the allowed list, or the execution of an unexpected command. In addition, we have made it possible to link multiple actions together in chronological order.</p>https://blog.ast.moe/en/blog/2026-10-08-3/Thu, 08 Oct 2026 22:24:12 +0900https://blog.ast.moe/en/blog/2026-10-08-3/<p>When you run <code>npm install</code>, it not only downloads the package but may also execute scripts that the package provides. If you run that code in your regular development environment, you can access files readable by the executing user and the environment variables passed to the process.</p> <p>To isolate such development commands and track what they access, we have built Izanagi in Rust (<a href="https://github.com/ieee0824/izanagi">source</a>). It records file accesses, network communications, and child‑process launches so you can examine the behavior of the executed code.</p>